Slashdot Mirror
European Court Rules Companies Must Tell Employees of Email Checks (reuters.com)
Companies must tell employees in advance if their work email accounts are being monitored and such checks must not unduly infringe workers' privacy, the European Court of Human Rights ruled on Tuesday. From a report: In a judgment in the case of a man fired 10 years ago for using a work messaging account to communicate with his family, the judges found that Romanian courts failed to protect Bogdan Barbulescu's private correspondence because his employer had not given him prior notice it was monitoring his communications. Email privacy has become a hotly contested issue as more people use work addresses for personal correspondence even as employers demand the right to monitor email and computer usage to ensure staff use work email appropriately. Courts in general have sided with employers on this issue.
So I'm going to assume they can and will read anything I do at work and act accordingly.
Privacy is one thing, and most businesses--even Federal agencies--confer a limited personal use policy, allowing you to browse the 'net and do things with their equipment as long as you do your job. This was actually directly described on the MOTD at log-in at the Social Security Administration. There's a reasonable expectation of privacy; it's also their system, and what you do is subject to inspection.
So yeah, they won't suck up your cookies, hack your gmail, and snoop your bank accounts; they will read your e-mail and inspect the files on your computer if they so choose.
Maybe don't e-mail naked pictures of yourself using the corporate email account. It also really irritates your mail admin when the FBI shows up and requires access to search your company e-mail the morning after they pick you up for child pornography.
Support my political activism on Patreon.
If you're using company equipment, it is logical to assume it's being monitored. To believe otherwise would be quite naive. If you need to be told, you probably need a tag on your mattress that says: "Do not eat"
Who would use the mail box of the office for something personal ?
At our day and time, the smartphone is more than enough for the odd 3 lines messages for emergencies.
If you need more, do it at home, not on your company's dime.
Irrelevant news and morons using moderation to mod down what they disagree on. 2018 resolution: so long.
The case at hand was about en employee using Yahoo messenger for private use, not email.
The verdict is about electronic communication.
So how come the headline is only about email?
If I remember correctly, there was a case where a single-parent worker was summarily fired for using an office workstation to write an instant message to his elementary school aged daughter, telling her that he's been ordered to work overtime and she shall arrange supper for herself. The court sided with the company...
The "notice" will be added to the employment contract, somewhere on page 20 of the legalese essay: "we might monitor your email at any time".
... in a Technology Administrator Policy and designate an administrator.
I'm retired now, and when I hired on at a law firm 20 years ago, I wrote that policy and amended it as things changed.
I blocked shit like match.com, Facebook, Twitter, etc.
I listed taboos like using business email for non-business purposes and I stated clearly that, at the direction of the partners, I would be monitoring emails, browser history, etc.
For each and every new hire, I read the Policy to them in the kitchen area and invited them to ask question then, and at any other time during their employment.
The last page had a place for two signatures/dates:
- Theirs, acknowledging that they participated in the counseling
- Mine, acknowledging same.
I got a few calls regarding wrongful termination during the years and, in one matter, the fired employee said, "Well, everyone else was doing it."
I told the work comp lady to add, "Line item 6.1.a, 'Report any violations or suspected violations of this policy to the Technology Administrator."
It little behooves the best of us to comment on the rest of us.
As soon as it becomes impossible for an organization to maintain complete control of the communications on it's own networks, connections to other networks, and data transfers to and from those external networks, you have given carte blance to those who would steal company secrets, data, and technology.
This is insane. Folks have cell phones that they don't have to put on corporate/company networks. Use that for personal.
Check your premises.
Phenominal
Pa-Hee-Ha-Heenus
Phenominal
Pa-Hee-Hee-Nus
Phenominal
Pa-Hee-Ha-Heenus-Ha-Heenus-Ha-Heenus-Ha-Heenus-Ennus
Pa-Hah-He-He-Nus!
The ruling aside, there's no better way to avoid workplace communication monitoring than to use a smartphone with mobile data network connection. Most plans have more than enough data to give you everything you need while you're at work. It's pointless and counterproductive on so many levels to log into anything personal on work machine.
That this was more than a couple emails to family when working late hours, it was 10 years ago, so ya Blackberry's were out, Iphone just getting started, if it was just a quick email saying hi to brother across the country I would be tempted to have some sympathy for the guy, but appears to be flagrant abuse.
Why would you even do that? Not smart.
As a company, or someone wishing to start one, has to deal with more and more regulation, when do they just shrug?
Yeah, shouldn't that be the base assumption?
No. It might be the cautious assumption but that does not mean that someone who expects some level of privacy has unreasonable expectations. There are many different levels of private email correspondence. For example, if I email my wife to let her know that I will be home late because of work I would not expect my employer to fire me for personal use of work email. However, if you tried to run a small business of eBay selling things through your work email then yes I would expect any employer would likely fire you for that!
This means that there is a certain grey area between what an employer wants to let you do and what a reasonable person might assume that they can do. Hence this ruling seems to make a lot of sense: employers can do what they want with an employee's email account, they just have to say exactly what they will do and what they will allow beforehand. This way everyone's different assumptions about what is ok do not matter because the rules are spelled out.
My current employer notifies new employees that all traffic over the network may be monitored and all email or communications on the company's systems are monitored.
They actually aren't, but it protects them from issues like this if they do choose to monitor some systems.
I assume that this is what will happen in Europe.
and Liberty
both of which are lacking in America, but still exist in the EU
-- Tigger warning: This post may contain tiggers! --
Back in the years of the BBS, system owners/operators had to display a message to their users when they logged in about the Electronic Communication Privacy Act of 1986 and specifically say if they could in fact guarantee the user's privacy for email, chat logs, etc. I am not able to find the exact text that was displayed, sorry.
Agrisea Tsunami - Epyc Servers... https://agrisea.net/products
From the summary, I had assumed that this was a standard case of a company accessing a person's email that was sent through that company's own mail server. I was pretty much ready to side with the employer. If you send an email through your company's mail server, you should expect that someone might view that email. Even if the employer isn't snooping, there are any number of reasons why someone at the company may need to review your work emails. However, the article states:
The company had presented Barbulescu with printouts of his private messages to his brother and fiancée on Yahoo Messenger as evidence of his breach of a company ban on such personal use.
So that makes it sound like this guy was using a personal Yahoo Messenger account. So that kind of takes me in the other direction, in favor of the employee's right to privacy. As a general rule, I don't think that your company should have the right to access your personal email/IM accounts, even if you happen to access them on work devices.
However, that doesn't really explain how they got access to his chats, unless they were stored on his work computer. I don't feel comfortable saying that a company shouldn't be allowed to review the contents of a company-owned computer. And this is further complicated by the fact that the employee stated, in writing, that the account was being used solely for work purposes. In that case, I could see an argument that the account is a work account, not a personal account, and so the employer should be allowed to access it.
In any case, I think there's some space between "what an employer should be legally allowed to do" and "what an employer should do". Even if employers can spy on employees and review private email, they should try to avoid reading anything that's not business related.
So that makes it sound like this guy was using a personal Yahoo Messenger account. So that kind of takes me in the other direction, in favor of the employee's right to privacy. As a general rule, I don't think that your company should have the right to access your personal email/IM accounts, even if you happen to access them on work devices.
Work devices are work devices. You want a personal device, carry a personal device. I don't side with the employee in this case. IT security involves dealing with threats and sometimes those threats can be internal as well.
That said either side of an argument is usually painted in rose. The reality is probably:
a) the guy was caught transmitting something sensitive.
b) the guy was seriously slacking off and spending half the day on personal stuff.
c) the guy was toxic to the company and they were looking to any reason to get rid of him.
However, that doesn't really explain how they got access to his chats
10 years ago security wasn't high on anyone's agenda. There certainly was little to no talk about encryption. Maybe the transparent proxy caught all the MITM-SSL traffic as is pretty standard on a company PC.
So that makes it sound like this guy was using a personal Yahoo Messenger account. So that kind of takes me in the other direction, in favor of the employee's right to privacy. As a general rule, I don't think that your company should have the right to access your personal email/IM accounts, even if you happen to access them on work devices.
It can be a very fine line, but as the steward of an employers data, networks, and security policy, IT staff are between a rock and a hard place here.
The company is legally responsible for vetting contractually and/or legally burdened data from leaving any internal compartmentalized or secured areas to outside networks such as the Internet.
There is really only two ways to do this.
A) Monitor the data egressing the network, or
B) Disallow any and all types of general network access that would permit this in the first place.
As a technology advocate myself, I would much prefer the option of simply treating all employees as trusted adults capable of such restrictions and care on their own.
However not only do the lesser technologically inclined not always have the knowledge or skills to do this even when it is their intent, but the fact is there does exist bad actors that for whatever reasoning are actively going to try and harm you for their gain.
For this reason it falls upon us to practically guarantee the protection of the companies data and information.
Personally I know I would absolutely hate and despise operating under work conditions where all of the company resources are locked down and restricted to the point of not being useful, such as a whitelist of vendors and customers for email and websites, or those simply blocked entirely.
On the other hand, I know if I went to my boss to present this as a problem needing a solution applied, and gave the two options above... He very likely wouldn't share my opinions on the moral downsides of option "B", and would very likely see it as the simplest, cheapest, and best option to solve the problem.
And while this wouldn't apply to my current boss, I have in the past worked for people who would immediately question why I am even presenting such a thing as a problem to them in the first place, since to them option "B" would be the glaringly obvious only answer, and "shame on me" for not recognizing that "fact".
In the end I very much worry laws like these will less protect an employees privacy and more simply force companies to block any and all such privileges in the first place, both to meet their other legal and contractual obligations as well as to head off any more removal of things they can or can't do with their own property.
I'm not 100% sure but believe to remember from a few years ago when this thing was in another court that he was using a company account designated for client contact to communicate with his family.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
The company is legally responsible for vetting contractually and/or legally burdened data from leaving any internal compartmentalized or secured areas to outside networks such as the Internet.... In the end I very much worry laws like these will less protect an employees privacy and more simply force companies to block any and all such privileges in the first place
Yeah, it is a bit complicated. The need for security varies from industry to industry, and business to business. In many cases, the best option is just to treat employees as trusted adults. Or more to the point, to deal with the need to secure data on a different level, preventing employees from accessing it in the first place rather than trying to police what they do with it. That's generally a better approach, since once the data is available to people, they might find some way to share it.
There's also the question of what level, and to what extent, you want to monitor or control user access. For example, are you just monitoring that some HTTPS traffic went to some site, or are you introducing some kind of proxy that's performing a MITM attack so that you can see the content of the traffic? Are you trying to blacklist a few sites, or instead block everything and only whitelist a few sites?
I don't think there's a correct answer, but you have to tailor the security to your needs. There may be a middle ground, e.g. block all IM but the employer-approved IM, and then have that traffic monitored and archived. That way, you make it clear to the employees that this is a company-owned service, and communications are not private. I think setting up a MITM monitoring system is worse, since it gives people the illusion that their traffic might be private.
In Germany (part of the EU) the ruling is like this:
An employer has to tell the employee (ideally based in the contract) if company e-mail and equipment is for business use only. This has to be true for all employees.
If an employer does not provide that Information ruling states that the employer has to accept that e-mail and equipment is used for personal matters. The only question here is how much - as in if the employee manages to fullfill his 8 hours of work per day and lets say adds 1 hour personal use.
The tricky part is this:
If the employer allows private usage of e-mail/equipment he becomes a de-facto service provider and has to yield to the law of privacy of correspondence - which means he is not allowed the secretly access equipment or read the e-mail, even if business related
If the employer rules that e-mail and equipment is for business only (s)he can legally read e-mails and access equipment without the employees knowledge.
An additional tricky part is if an employer decides later to cut down on it the employees could claim a right of custom and practice which means it could take months or years before all machines, e-mails and such are clean of private usage. only then the employer would be able to legally access the e-mail or equipment.
Last, but not least, the European Court in question was the Euorpean Court of Human Rights, not the court dealing with the European Union. The participating countries have promised to yield to the rulings in their own private matters, but the ruling limited application as the Court is not part of any justice or executive system in any country of the european union (and more). So it is a court without teeth.